Researchers say pirates will likely use easier routes to crack the scheme, but that espionage risk is possible

Intel Corp. (INTC) has enjoyed a profitable ride off its High-bandwidth Digital Content Protection (HDCP) hardware, which sits inside nearly every TV/computer monitor with HDMI or DVI input. The HDMI/DVI chips with HDCP functionality open a secure encrypted channel from a source (e.g. a Blu-ray player) to a computer monitor or TV.

I. Defeating HDCP Was Easy

Even as other content protection schemes were defeated, HDCP hung strong. But in 2010, the master key leaked for HDCP giving the world the first hope of cracking the scheme. But Intel reassured its partners that they had nothing to worry about -- they laughed that unless would-be hardware hackers "made a computer chip" the scheme would be safe.
The only thing they forgot about was the growing amount of cheap reprogrammable chips known as field programmable gate arrays (FPGAs), which allow you to quickly make and test chip designs in software.

Using an ATLYS board manufactured by a company named Digilent, researchers at the Ruhr-Universität Bochum (RUB) -- a college in the town of Bochum, located roughly 2 hr. and 15 min. northwest of Frankfurt -- were able to carry out a-man-in-the-middle attack, with the FPGA posing as a legitimate interface chip and going undetected.

Prof. Dr.-Ing. Tim Güneysu, the principal investigator and senior author of the work summarizes [press release], "We developed an independent hardware solution instead, based on a cheap FPGA board. We were able to tap the HDCP encrypted data streams, decipher them and send the digital content to an unprotected screen via a corresponding HDMI 1.3-compatible receiver."

The ATLYS board cost only 200€ (~$267). The board comes with a Xilinx, Inc. (XLNX) Spartan-6 series FPGA, DRAM, HDMI interfaces, and a serial RS232 port. Most of the work on the project was carried out by final-year student Benno Lomb.

The little board that slew HDCP 1.x. [Image Source: RUB]

Dr.-Ing. Güneysu summarizes Intel's claims of invulnerability as foolish arrogance. He states, "[O]ur intention was to fundamentally investigate the safety of the HDCP system and to financially assess the actual cost for the complete knockout. The fact that we have achieved our goal in a degree thesis and with material costs of approximately 200 Euro definitely does not speak for the safety of the current HDCP system."

II. The Current Dangers -- Piracy, Not so Much, Espionage Maybe.

The work will be presented at the international security conference ReConFig 2011 in Cancun, Mexico, which is being held between Nov. 30 (Wed.) and Dec. 2 (Fri.).

It is unknown whether the team will publish their FPGA code, which could allow pirates and hardware hackers to buy FPGAs and defeat the protection. However, they insist that their goal was not to promote piracy. They say there's other far simpler ways of defeating HDCP available to pirates.

In October 2008 Intel released HDCP 2.0, which provides additional protection against this kind of attack. The hardware is currently on HDCP 2.1. But legacy systems abound and remain vulnerable to the HDCP 1.x capable attacks. The researchers say this could pose a security threat to the military or government agencies.

It also has:GPIO includes 8 LEDs , 6 buttons, & 8 slide switchesShips with a 20W power supply and USB cable

I'm not an engineer but this is an interesting board. They must use this board to develop all kinds of interesting hardware applications:

quote: The Atlys circuit board is a complete, ready-to-use digital circuit development platform based on a Xilinx Spartan 6 LX45 FPGA. The on-board collection of high-end peripherals, including Gbit Ethernet, HDMI Video, 128Mbyte DDR2 memory array, audio and USB ports make the Atlys board an ideal host for complete digital systems built around embedded processors like Xilinx’s MicroBlaze. Atlys is fully compatible with all Xilinx CAD tools, including ChipScope, EDK, and the free WebPack, so designs can be completed with no extra costs.

I guess if you would like to learn and design firmware you could buy this board as a hobby or, as someone mentioned below, as a student. I wonder which software you use to program it. Do you program it in assembly language? It costs $349.00 or $199.00 for students.

Like I mentioned earlier, the board does absolutely nothing in its base form. FPGA development boards come with a slew of chips attached to them so that you might use a board to prototype any number of different kinds of machines.

There is no processor and the board is not a computer of any kind. The Ethernet PHY doesn't enable networking, the RS-232 interface doesn't enable serial communication, the USB port doesn't let you use a USB device with it (or use itself as a USB device), and the AC97 codec doesn't generate audio.

Nothing at all happens until you design a state machine that interacts with those various chips in ways which make them do something. This is done purely by toggling signal pins high and low in patterns that cause the chip on the other end to respond in a predictable way. These state machines are written in HDLs (hardware descriptive languages) like Verilog and VHDL, not software programming languages. The syntax is similar in a lot of ways, but the fundamentals about what you're actually doing with the code are very different.

FPGAs are like an ASIC made out of Playdoh. They don't execute instructions when you program them. What you do instead is program them with a logical electrical model which is loaded into the device's cells. These cells contain inputs, outputs, and a LUT. The cells can be made to change their outputs depending on what the inputs are. When you stick a bunch of those together, you create a digital logic system--a state machine. You could create a CPU that executes instructions inside the FPGA itself, but the FPGA is not itself analogous to a computer.

On a side note, the FPGA itself is about a $50 chip when purchased in quantities of 1. The rest of the cost goes to whatever else is on the board and profit for Digilent. It's worth noting that you could make your own board without the stuff you don't need for about $20.

Some of those "state machines" ARE micro-processors. At least one real computer has been released using an FPGA as a 'programmable' CPU allowing programs to be run on multiple chip architectures that can be soft-loaded.

A research machine made for the military used 1 FPGA to do image processing that required multiple custom chips. The design reprogrammed the FPGA between processing stages ... FPGA based computers are very versatile :)

In this case the FPGA was loaded with a state machine that emulates a licensed HDMI 1.x connection. The next step will be to design a state machine that emulates a licensed HDMI 2.x connection and publish the code. When that is done, HDMI will no longer be a secure connection :)

This article does not say a CPU is included in the emulation, but if one is required an FPGA can be a CPU.

It's even something most FPGA manufacturers will throw at you for free that you're welcome to load into projects and use (*Blaze from Xilinx, Nios from Altera, etc). I've created them (CPUs, entire computers) from scratch myself in my own projects using Xilinx FPGA products, actually. I'm definitely aware of it.

quote: I have absolutely no clue where you got that idea... but apparently neither you or the author know anything about FPGAs.

That a silly comment. I own a Spartan 3 Xilinx board from Digilent. Haven't used it years, but I programmed loads of designs back in my undergrad years, though mostly boring stuff like checkout machine software chips.

To be honest I remember the basics, but would need a refresher to do anything serious.

I had a buddy who did essentially a 3D maze game on a Spartan 3, complete with raytracing. Now THAT was sweet.